Uploaded image for project: 'MariaDB Server'
  1. MariaDB Server
  2. MDEV-32406

Segmentation fault at /mariadb-11.3.0/sql/item_subselect.cc:3114

    XMLWordPrintable

Details

    • Bug
    • Status: Closed (View Workflow)
    • Major
    • Resolution: Duplicate
    • 11.3.0
    • N/A
    • Optimizer, Server
    • None
    • Ubuntu 20.04

    Description

      Run these queries in release build:

      CREATE TEMPORARY TABLE t0 ( c6 INT DEFAULT ( -91 ) DEFAULT ( CONVERT ( -1 , FLOAT ) % RAND ( ) ^ NULLIF ( -68 , -83 ) ) , c62 INT ) ;
      INSERT INTO t0 VALUES ( DEFAULT , DEFAULT ) , ( DEFAULT , DEFAULT ) ;
      CREATE INDEX i0 ON t0 ( c62 ) ;
      INSERT IGNORE INTO t0 VALUES ( 124 , 60 ) , ( -103 , FIND_IN_SET ( -823740468436690387 , '!z;fn7p/I"l(0=6!kj#<pW`AzXa/?V.f2.yF' ) ) ;
      SELECT t1 . c24 AS c46 FROM ( SELECT + EXISTS ( SELECT 63 AS c26 ) * PI ( ) AS c24 FROM t0 ) AS t1 JOIN t0 ON REVERSE ( -89 ) NOT IN ( 56 , -55 , -45 = ( SELECT FLOOR ( RAND ( 41 != -113 IS UNKNOWN ) << 61 LIKE ( REPLACE ( -40 , 'cW>EYEbXC/`EFp)iOW%`sv:$wbNA2hUq' , 'n\\P\';5H?"~hq,(;.3Z@r2>u=[ s}h80"Djhu+L6vR' ) IS FALSE ) ) AS c2 FROM t0 LIMIT 1 ) ) LEFT OUTER JOIN t0 AS t2 ON TRUE NOT REGEXP SQRT ( CONVERT ( -104 , UNSIGNED ) % RAND ( ) - RAND ( 76 ) << + EXISTS ( SELECT -64 AS c49 WHERE CONVERT ( FIELD ( t0 . c6 , '"1+"UjbNk:5J3cAgVY&VOEFQ1~9mJ`bv5B' , '[j`u=@jTsvSM+7[8I"n^B0VDmM_uw!oXX>m"OiS7j9Pf6bbo+/92mf~R1*KnMdeC' ) % RTRIM ( ( CONVERT ( t2 . c6 , UNSIGNED ) ) / ASIN ( t2 . c62 ) OR LOCATE ( c24 , ',@m6|7idS&.ffCq\'1`UU;(6AZTU"7Nz#1d4|oeNe
      aDZpbuo
      ^KZG;
      561' , 'z5QYD' ) NOT BETWEEN 79 AND 38 ) , UNSIGNED ) IS TRUE GROUP BY c24 ) IS NULL ) << t2 . c6 ;

      Will trigger Segmentation fault.
      GDB info:
      Thread 16 "mariadbd" received signal SIGSEGV, Segmentation fault.
      [Switching to Thread 0x7fffd242e300 (LWP 3141)]
      0x00000000015cd3e4 in Item_exists_subselect::exists2in_processor (this=0x629000093290, opt_arg=<optimized out>)
      at /home/wx/mariadb-11.3.0/sql/item_subselect.cc:3114
      3114 JOIN *join= first_select->join;
      (gdb) p first_select
      $33 = (SELECT_LEX *) 0x0

      #0 0x00000000015cd3e4 in Item_exists_subselect::exists2in_processor (this=0x6290000932a8, opt_arg=<optimized out>) at /home/wx/mariadb-11.3.0/sql/item_subselect.cc:3114
      #1 0x000000000088e804 in Item_args::walk_args (this=0x6290000935c8, processor=<optimized out>, walk_subquery=<optimized out>, arg=0x62b00016c218) at /home/wx/mariadb-11.3.0/sql/item.h:2796
      #2 Item_func_or_sum::walk (this=0x629000093550, processor=<optimized out>, walk_subquery=<optimized out>, arg=0x62b00016c218) at /home/wx/mariadb-11.3.0/sql/item.h:5496
      #3 0x000000000138f19c in Item_direct_view_ref::walk (this=0x6290000bcfe8, processor=(bool (Item::*)(Item * const, void *)) 0x62b00016c218, walk_subquery=<optimized out>, arg=0x62b00016c218) at /home/wx/mariadb-11.3.0/sql/item.h:6103
      #4 0x000000000088e804 in Item_args::walk_args (this=0x6290000b6290, processor=<optimized out>, walk_subquery=<optimized out>, arg=0x62b00016c218) at /home/wx/mariadb-11.3.0/sql/item.h:2796
      #5 Item_func_or_sum::walk (this=0x6290000b6218, processor=<optimized out>, walk_subquery=<optimized out>, arg=0x62b00016c218) at /home/wx/mariadb-11.3.0/sql/item.h:5496
      #6 0x000000000088e804 in Item_args::walk_args (this=0x6290000b64e8, processor=<optimized out>, walk_subquery=<optimized out>, arg=0x62b00016c218) at /home/wx/mariadb-11.3.0/sql/item.h:2796
      #7 Item_func_or_sum::walk (this=0x6290000b6470, processor=<optimized out>, walk_subquery=<optimized out>, arg=0x62b00016c218) at /home/wx/mariadb-11.3.0/sql/item.h:5496
      #8 0x00000000013d9e09 in Item_cond::walk (this=0x6290000b65d0, processor=&virtual table offset 1040, walk_subquery=<optimized out>, arg=0x62b00016c218) at /home/wx/mariadb-11.3.0/sql/item_cmpfunc.cc:5202
      #9 0x000000000088e804 in Item_args::walk_args (this=0x6290000b6898, processor=<optimized out>, walk_subquery=<optimized out>, arg=0x62b00016c218) at /home/wx/mariadb-11.3.0/sql/item.h:2796
      #10 Item_func_or_sum::walk (this=0x6290000b6820, processor=<optimized out>, walk_subquery=<optimized out>, arg=0x62b00016c218) at /home/wx/mariadb-11.3.0/sql/item.h:5496
      #11 0x000000000088e804 in Item_args::walk_args (this=0x6290000b6990, processor=<optimized out>, walk_subquery=<optimized out>, arg=0x62b00016c218) at /home/wx/mariadb-11.3.0/sql/item.h:2796
      #12 Item_func_or_sum::walk (this=0x6290000b6918, processor=<optimized out>, walk_subquery=<optimized out>, arg=0x62b00016c218) at /home/wx/mariadb-11.3.0/sql/item.h:5496
      #13 0x000000000088e804 in Item_args::walk_args (this=0x6290000b6a50, processor=<optimized out>, walk_subquery=<optimized out>, arg=0x62b00016c218) at /home/wx/mariadb-11.3.0/sql/item.h:2796
      #14 Item_func_or_sum::walk (this=0x6290000b69d8, processor=<optimized out>, walk_subquery=<optimized out>, arg=0x62b00016c218) at /home/wx/mariadb-11.3.0/sql/item.h:5496
      #15 0x000000000088e804 in Item_args::walk_args (this=0x6290000b6b08, processor=<optimized out>, walk_subquery=<optimized out>, arg=0x62b00016c218) at /home/wx/mariadb-11.3.0/sql/item.h:2796
      #16 Item_func_or_sum::walk (this=0x6290000b6a90, processor=<optimized out>, walk_subquery=<optimized out>, arg=0x62b00016c218) at /home/wx/mariadb-11.3.0/sql/item.h:5496
      #17 0x0000000000c10833 in JOIN::optimize_inner (this=<optimized out>) at /home/wx/mariadb-11.3.0/sql/sql_select.cc:2168
      #18 0x0000000000bfc156 in JOIN::optimize (this=0x6290000be238) at /home/wx/mariadb-11.3.0/sql/sql_select.cc:1944
      #19 0x0000000000ab5421 in st_select_lex::optimize_unflattened_subqueries (this=<optimized out>, const_only=<optimized out>) at /home/wx/mariadb-11.3.0/sql/sql_lex.cc:4916
      #20 0x0000000000c0856c in JOIN::optimize_stage2 (this=0x6290000ba208) at /home/wx/mariadb-11.3.0/sql/sql_select.cc:3229
      #21 0x0000000000c13911 in JOIN::optimize_inner (this=<optimized out>) at /home/wx/mariadb-11.3.0/sql/sql_select.cc:2650
      #22 0x0000000000bfc156 in JOIN::optimize (this=this@entry=0x6290000ba208) at /home/wx/mariadb-11.3.0/sql/sql_select.cc:1944
      #23 0x0000000000be4fdf in mysql_select (thd=<optimized out>, thd@entry=0x62b00016c218, tables=<optimized out>, fields=..., conds=<optimized out>, og_num=<optimized out>, order=<optimized out>, group=0x0, having=0x0, proc_param=0x0, select_options=<optimized out>, result=0x6290000b8080, unit=0x62b0001704a8, select_lex=0x629000091980) at /home/wx/mariadb-11.3.0/sql/sql_select.cc:5235
      #24 0x0000000000be4596 in handle_select (thd=thd@entry=0x62b00016c218, lex=<optimized out>, lex@entry=0x62b0001703c8, result=<optimized out>, result@entry=0x6290000b8080, setup_tables_done_option=<optimized out>, setup_tables_done_option@entry=0) at /home/wx/mariadb-11.3.0/sql/sql_select.cc:628
      #25 0x0000000000b3df18 in execute_sqlcom_select (thd=0x62b00016c218, all_tables=<optimized out>) at /home/wx/mariadb-11.3.0/sql/sql_parse.cc:6013
      #26 0x0000000000b2cd51 in mysql_execute_command (thd=0x62b00016c218, is_called_from_prepared_stmt=<optimized out>) at /home/wx/mariadb-11.3.0/sql/sql_parse.cc:3912
      #27 0x0000000000b1fe79 in mysql_parse (thd=thd@entry=0x62b00016c218, rawbuf=<optimized out>, length=<optimized out>, parser_state=<optimized out>, parser_state@entry=0x7fffd242ca80) at /home/wx/mariadb-11.3.0/sql/sql_parse.cc:7734
      #28 0x0000000000b19069 in dispatch_command (command=<optimized out>, thd=0x62b00016c218, packet=<optimized out>, packet_length=<optimized out>, blocking=<optimized out>) at /home/wx/mariadb-11.3.0/sql/sql_parse.cc:1893
      #29 0x0000000000b20b71 in do_command (thd=0x62b00016c218, blocking=true) at /home/wx/mariadb-11.3.0/sql/sql_parse.cc:1406
      #30 0x0000000000f03476 in do_handle_one_connection (connect=<optimized out>, put_in_cache=<optimized out>) at /home/wx/mariadb-11.3.0/sql/sql_connect.cc:1445
      #31 0x0000000000f02eb9 in handle_one_connection (arg=arg@entry=0x608001a24fb8) at /home/wx/mariadb-11.3.0/sql/sql_connect.cc:1347
      #32 0x0000000001a00c1b in pfs_spawn_thread (arg=0x617000005118) at /home/wx/mariadb-11.3.0/storage/perfschema/pfs.cc:2201
      #33 0x00007ffff79f7609 in start_thread () from /lib/x86_64-linux-gnu/libpthread.so.0
      #34 0x00007ffff770f133 in clone () from /lib/x86_64-linux-gnu/libc.so.6

      Attachments

        Issue Links

          Activity

            People

              Unassigned Unassigned
              Xin Wen Xin Wen
              Votes:
              0 Vote for this issue
              Watchers:
              3 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved:

                Git Integration

                  Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.